Re: slocate bug.

Heres the details on Mandrake Linux elguapo@linux elguapo$ ls -al which slocate -rwxr-sr-x 2 root slocate 24956 Apr 6 2001 /usr/bin/slocate elguapo@linux elguapo$ uname -a Linux linux.ckfr.com 2.4.3-20mdk 1 Sun Apr 15 23:03:10 CEST 2001 i686 unknown elguapo@linux elguapo$ cat /etc/redhat-release...

slocate bug.

Hey, Its a good time to announce that 2xs security LTD. decided to create a research team in order to focus on finding new bugs, further more we managed to develop a security tool to discover bugs/security flaws. In the near future, the tool itself will became an open source project. slocate Secu...

dnrd 2.10 dos

Program: dnrd Version: 2.10 Distro: n/a Problem: There are various problems with dnrd's dns request and reply functions, that cause it to crash. Reproduce: Using two consoles, I did the following Terminal one got: andrewg@blackhole /data/audit/dnrd-2.10/src$ gdb dnrd GNU gdb 5.0rh-5 Red Hat Linux...

'/usr/bin/at 31337 + vuln' problem + exploit

Affects: /usr/bin/at To check if you are potentially vulnerable to this exploit, execute: /usr/bin/at 31337 + vuln If you are vulnerable this will cause: Segmentation fault If not, there will be a message similar to: Garbled time possibly with some extra information The problem is caused by a bug...

Clanlib overflow / Super Methane Brothers overflow

Charles stayed up all night and found a hole in Eterm so I felt obligated to stay up all night and find something else wrong on my box too. In doing so I found an overflow in a game included with Mandrake 8.1 called Super Methane Brothers. $HOME=bof here then run /usr/games/methane. Inturn that...

Buffer overflow vulnerability in grpck command line utility

Overview The CERT/CC has received a public report of a local buffer overflow vulnerability in the grpck utility. Description The grpck utility performs syntax checking of /etc/group and /etc/gshadow group information files. This utility contains a buffer overflow vulnerability in the section of...

artsd overflow

-----BEGIN PGP SIGNED MESSAGE----- Happy new year. Take a look at this: r00t:$ ls -las which artswrapper which artsd 4 -rwsr-xr-x 1 root root 4048 Dec 28 22:43 /usr/bin/artswrapper 120 -rwxr-xr-x 1 root root 117644 Dec 28 22:43 /usr/bin/artsd r00t:$ artsd -m perl -e 'print...

Buffer overflow in Python code

Hi, I've found buffer overflow in Python 2.1.1 source code. Maybe there're many others The buffer overflow is in the file traceback.c in the directory Python of the Python source code. Simply there's a sprintf done in this way: sprintflinebuf,FMT,filename,lineno,name What cause the overflow is th...

gm4 format strings on OSX

This in itself is not an issue due to the lack of a suid bit... however if I remember correctly there were a few linux suid root binaries that were reliant upon m4 in some way or another thus making them vulnerable to a local root expoit. This is on osx 10.1. OSXBOX: elguapo ls -al which m4...

OpenUNIX 8 & Unixware possible local root

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Another dt series bug... $ uname -a OpenUNIX zen 5 8.0.0 i386 x86at Caldera UNIXSVR5 $ id uid=101fixxxer gid=1other $ ls -al /usr/dt/bin/dtterm - -r-sr-xr-x 1 root bin 60892 Haz 10 05:03 /usr/dt/bin/dtterm $ /usr/dt/bin/dtterm -tn perl -e 'print...

CVE-1999-1448

Affected software: Eudora and Eudora Light before 3.05. Vulnerable component: e-mail processing using dates in messages. Root cause: certain dates cause Divide By Zero errors (dates before 1970) or segmentation faults (dates ~100 years after current date). Impact: remote attacker could cause a cr...

suid xman 3.1.6 overflows

xman from at least X11R6-contrib-3.3.2-3.i386.rpm suffers from a classic overflow [email protected] is noted as the packager of this RPM. I do not know the author. root@linux lib ls -al which xman -rwxr-sr-x 1 root man 41076 Jun 17 1998 /usr/X11R6/bin/xman root@linux lib xman root@linux li...

Sun SunVTS 4.x - PTExec Buffer Overflow

Sun SunVTS 4.x - PTExec Buffer Overflow source: https://www.securityfocus.com/bid/2898/info SunVTS is the Sun Validation Test Suite, distributed and maintained by Sun Microsystems. The SunVTS is used to test various components of OEM Sun hardware, and can also be used to stress-test components an...

Sun SunVTS 4.x - PTExec Buffer Overflow

source: https://www.securityfocus.com/bid/2898/info SunVTS is the Sun Validation Test Suite, distributed and maintained by Sun Microsystems. The SunVTS is used to test various components of OEM Sun hardware, and can also be used to stress-test components and sub-components. A buffer overflow in t...

suid scotty / ntping overflow

here is the offending code and the attached letter has the general information for this issue. in /home/d0tslash/scotty-2.1.0/tnm/ntping/ntping.c char hname; / hostname / ... else char tmp 512; struct hostent hp; strcpy tmp, hname; ifdef HAVERES / try to spend no longer than some seconds: /...

HylaFAX vulnerability

Hi, I've found classical format bug while I was playing with HylaFAX server v4.1 beta2: $ -u /usr/sbin/hfaxd && /usr/sbin/hfaxd -q 'nn' SUID uucp Segmentation fault It crashes while calling syslog with user supplied fmt. Looks nasty. Sorry, I have no working exploit, I won't have one and I have n...

Solaris 5.8 snmpd Vulnerability

Description The /opt/SUNWssp/snmpd command SNMP proxy agent is suid root and contains a buffer overflow, the problem occurs when it copy his own name argv0 to an internal variable without checking out its lenght and this causes the overflow. Vulnerable Version Sun Solaris 5.8 Technical Descriptio...

Format string bug in startinnfeed

Description -------------- The 'startinnfeed' binary contains various format string bugs. Most of the command line options passes user given arguments to 'syslog' as format string. For example: paul@ps:/usr/home/paul /usr/lib/news/bin/startinnfeed -a "xxnnnnnnn" segmentation fault...

Solaris /usr/bin/cu Vulnerability

Description The /usr/bin/cu command contains a buffer overflow, the problem occurs when it copy his own name argv0 to an internal variable without checking out its lenght and this causes the overflow. Vulnerable Versions Sun Solaris 2.4 Sun Solaris 2.5 Sun Solaris 2.5.1 Sun Solaris 2.6 Sun Solari...

Solaris /usr/lib/exrecover buffer overflow

Hi, The /usr/lib/exrecover contains a buffer overflow this command is suid in Solaris 2.4/5/6 The problem occurs when it gets the second argument, it accepts the argument without checking out its lenght and this causes the problem. The overflow seems to be in the heap space. $ /usr/lib/exrecover...